search

napframework / nap

NAP Framework source code
https://nap-framework.tech
Mozilla Public License 2.0
404 stars 22 forks source link

Extend LicenseGenerator and mod_naplicense to support more crypto schemes #11

Closed ghost closed 2 years ago

ghost commented 2 years ago

Adds a couple overloads to validateLicense to support an optional "signing scheme" parameter. Justification is for future proofing as crypto algorithms can be broken and considered weak with research and time (e.g. SHA1 could become weak just as MD5).

This change was made with backwards compatibility in mind, avoiding any surprises to developers unless they explicitly add the new parameter to their calls to validateLicense and the "licensegenerator" tool.

Demo has been updated to show use of the signing scheme parameter and promote adoption of a stronger hashing function.

cklosters commented 2 years ago

Ideally, in the future, we use RTTI to automatically bind a name to a specific type, as declared by the SigningScheme. This would remove the need to declare the supportedSigningSchemes explicitly in the licencegenerator .cpp file. RTTI can be used to get all the supported names from the enum directly. This not possible at the moment because naprtti and mod_naplicense are not linked into the project.

ghost commented 2 years ago

I welcome this addition and understand the need for additional (stronger) crypto schemes. I have some small suggestions, see comments, but other than that everything looks fine and I'm willing to merge. Thanks!

Thanks for the feedback. I'll make the changes and push a commit when I have a little free time this week.

ghost commented 2 years ago

@cklosters I pushed a commit to improve the PR. Let me know if I missed anything.

I'm still exploring the project and will double-click on the RTTI portion. I haven't knowingly used it in C++ before but if it draws me in enough then don't be surprised to see a future PR on this topic. Thanks!

cklosters commented 2 years ago

Thanks for adding the RTTI type information to the enum. This allows us to automatically resolve the requested scheme at runtime through type inspection, when we link in mod_naplicense into the 'licensegenerator' tool in the future, bringing signing and verification together.

I'll take a look at your other changes asap. Thanks for taking the time to implement the changes, much appreciated.